Skip to content
OpenAdvisories
Medium ICSA-21-005-01 3 CVEs

Schneider Electric Web Server on Modicon M340

Published Jan 5, 2021 · Updated Jan 5, 2021

Vendor: Schneider Electric Product: M340 Communication Ethernet modules BMX NOC 0401 Product: M340 Communication Ethernet modules BMX NOE 0100 (H) Product: M340 Communication Ethernet modules BMX NOE 0110 (H) Product: M340 Communication Ethernet modules BMX NOR 0200H Product: M340 CPUs BMX P34x Product: Premium communication modules Product: Premium processors with integrated Ethernet COPRO TSXP574634, TSXP575634, TSXP576634 Product: Quantum communication modules 140NOC77101 Product: Quantum communication modules 140NOC78x00 Product: Quantum communication modules 140NOE771x1 Product: Quantum processors with integrated Ethernet COPRO 140CPU65xxxxx

Summary

Successful exploitation of these vulnerabilities may allow write access and the execution of commands, which could result in data corruption or a web server crash.

Vulnerabilities 3

  • Medium 6.3
    CVE-2020-7562

    A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premi…

  • Medium 6.3
    CVE-2020-7563

    A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Prem…

  • Medium 6.3
    CVE-2020-7564

    A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Serve…

Revision history

  1. #1

    ICSA-21-005-01 Schneider Electric Web Server on Modicon M340

References